Posted
by
Zonk
on Thursday December 07, 2006 @03:26PM
from the make-up-your-mind dept.

An anonymous reader writes "A week after the Justice Department cleared him of any wrongdoing, Chris Soghoian, the Indiana University PhD student who created an online boarding pass generator for Northwest Airlines to highlight security holes is on the government's 'no-fly' list. The Transportation Security Administration has now launched its own investigation, says Wired blog 27strokeB. The TSA is claiming that Soghoian 'attempted to circumvent an established civil aviation security program established in the Transportation Security Regulations,' violations of which carry fines of up to $11,000 per violation. That could be a steep fine, says Washingtonpost.com's Security Fix blog: 'Something like 35,000 people viewed and possibly used the boarding pass generator during the less than 72 hours that it was live on his site in November. Soghoian told WaPo: "If they decide that the only safe way for me to leave the country is by boat, then that's pretty much the end of my career here in the States. It's one thing to harass researchers, but if they can chase them out of the country, then that's a real chilling effect."'"

No kidding. This was an obvious loophole that had been pointed out a very long time ago.
Investigating the kid till you're blue in the face doesn't make the problem go away. Anyone with moderately good office-suite type computer skills could fake a bording pass.
TSA needs to focus on security, not obscurity of their obvious failures.
TSA needs to focus on security, not their obvious complicity with the airlines and the airlines heavey lobbying.

I was one but I didn't get to it from Slashdot. I got to it from several local bloggers that pointed it out.

Big fucking deal. It was an obvious security hole. If anything, he should be hailed, not jailed. But then again, we don't want to go out and make NWA (who fucking blow anyway) and the TSA look worse than they already do (if anyone is reading from MCO's TSA, fucking fix your system by doing a "best practices visit" to any number of other airports -- your system sucks even at 4:00AM)

He should be hailed. But the man who introduced fire to the world was burned at the stake. The man who introduced the wheel to the world was spun to death on the rack. The man who introduced sailing to the world was keelhauled. And the man who alerted others of a security flaw made his own country unsafe for him.

Bollocks he was. He (Prometheus) was chained to a rock, and an eagle would come every day and tear out his liver. Then, in the night, his liver would grow back. Sheesh, don't you kids learn any mythology anymore?

I was in line behind a TSA employee from a local small airport. She was telling the cashier that she had left the check to pay for a number of photocopied documents in her car and must retrieve it to pay. BUT she could not leave the documents and had to take them with her to the car as they were VERY VERY sensitive. Here's the kicker, she left them at Staples overnight to be copied.

I wonder if they let her sleep there and then shot the copier tech out in the alley?

So, what's the message these kind of reactions from the authorities send? To me it seems: "We don't really care if the system is really secure, there are always some friends might need to sneak in, one day. You just let yourself be searched and stay well put during the flight, cause if you don't we call you a terrorist. Trust us or else."

The fact is that this is bullshit, plain and simple. If this guy goes down or gets fined, I hope all nerds with any discretionary cash pony up a little to help him out. He did nothing wrong. As a matter of fact, a pretty persuasive argument could be made that he did something very right.

So, what's the message these kind of reactions from the authorities send?

I remember an American commedian (pity I don't remember who it was) responding to a bunch of germans who saw his act and thought it was hilarious. "Why don't we" the Germans asked him after the show, "have funny people like you in Germany?" "Because you gassed them all." He replied.

What is the actual value and goals of his research? A responsible researcher could have created a proof-of-concept, and raised awareness through media channels, research paper, blog etc. He should have also presented his research to the TSA and the airlines.
Instead what he did was not research. He created a website to create fake boarding passes and released it to the public. There was no academic benefit. If I created forged passport software and released it, that's not research.
Let's call this fo

This is something I was thinking. It is one thing proving there is an exploitation, it is another making it available to just anyone. The least he could have done is print void over the valid document he created. When you live in a society you need to exert a certain sense of responsibility. It should also be noted nothing is free from flaws and no security will ever be perfect.

I think the benefit is twofold:1) If he had just submitted a report to the TSA, it would get lost in the bureaucratic hell that is the TSA (or more likely, it would just be ignored, since fixing it would cost money and time.)

2) The media coverage that the site, and subsequent harassment that he has received has raised awareness far more than a report to the TSA or a blog entry ever would.

By bringing up the issue in a very public way, he has made many, many people very aware of the "security theatre" that th

A responsible researcher could have created a proof-of-concept, and raised awareness through media channels, research paper, blog etc. He should have also presented his research to the TSA and the airlines.

You seem to be forgetting that that had already been done, up to and including having the information on how to create a fake boarding pass published on a congressman's web site for a year or so prior to his arrest. And yes, there had already be newspaper articles on it, and the TSA was either well aware of it and doing nothing or unaware of it even though it had been reported to them multiple times.

Let's call this for what it is: trouble-making, not research.

Ok, fine. It was trouble making. But for whom? It didn't lower airport security one iota. Anyone who cared about it already new how to do it. What it did do, though, was make trouble for the fake "security" providers at the TSA, and point out the fact that they are ripping us (the taxpayers) off.

We saw the same sort of misleading argument come up when people started pointing out that US Military personnel were being given ineffective bulletproof vests; somehow the people who were trying to raise awareness of the issue were supposedly "helping the terrorists." Which is just nuts. What they were doing is making things uncomfortable for the crooks selling the defective jackets, and having zero impact on the people wearing them unless and until they could raise enough awareness of the issue to get things changed--in which case their actions would have helped the roops, not hurt them.

What is the actual value and goals of his research? A responsible researcher could have created a proof-of-concept, and raised awareness through media channels, research paper, blog etc. He should have also presented his research to the TSA and the airlines.Instead what he did was not research. He created a website to create fake boarding passes and released it to the public. There was no academic benefit. If I created forged passport software and released it, that's not research.Let's call this for what it is: trouble-making, not research.

I agree with you, but I still think his "trouble making" had value of raising awareness and also he should not be persecuted for it.

First of all, it's not "persecution." If he broke the law, then he needs to pay the penalty for that transgression. According to your semantics, we persecute murderers for murdering and thieves for stealing. I just don't think so.

What Chris S. did was just plain stupid. Yes, the web-based boarding document system was originally designed to keep unticketed passengers from getting onto planes, not from getting past the (at the time non-existent) TSA security points. Giving non-technical nogoodniks an eas

First of all, it's not "persecution." If he broke the law, then he needs to pay the penalty for that transgression.

Putting him on the "no fly" list has nothing to do with the law. He wasn't convicted in court - no we just had a bunch of mindless beaurocrats take it upon themselves to start handing down punishment to whoever they don't like.

This was almost exactly what I said [slashdot.org] when it first happened. It was also nothing unique in its implementation. I wrangled a -1 Troll, too!:-)

The problem exposes some very alarming trends I see in security research. It used to merely be embarassing when someone would release exploit code, but there really wasn't any recourse other than fix the flaw asap. Then, the separation between blackhat and whitehat hacking became more distinct... the responsible researchers started to notify the manufacturers with

I found a security hole in a "secrue" system used against pedophiles. I documented the system and submitted it thru channels to the proper authorities. I had to jump up a couple of levels before they could pay attention, but tha tis the way it is done.

Okay, so it's not research. But he's also not at the center of some vast terrorist conspiracy to forge boarding passes and blow up the US. The trouble he made was not a serious threat to US security, and if it was we are in some deep fucking trouble because it's clear that the gatekeepers are asleep at the switch.No, he has already been treated to the "troublemaker" gauntlet, had his brush with the government and his future almost turned upside down. He's still a kid, and kids will do things without thinki

Airport security is a joke, and all he did is point that out. I will point something else out. When I was waiting in the immensely long line for United Domestic Check-In, I noticed they controlled access to the door behind the ticket counter with a simple mechanical combination lock. I observed several United Airlines employees entering and every time I could clearly see the code being entered. I felt very secure.

19 Hijackers killed some 4000 people, or about 200 people per hijacker. Totally destroyed several buildings, but all in a geographic location. Very spectacular. One building, in another geographic location, partially destroyed. One plane, completely missed.I suspect that if they coordinated across 20 of the largest airports during the busiest time they could probably do a lot more damage (kill more people), without having to go through any security. But see, that wouldn't be as "Spectacular" as having build

Bigoted? Asshole?Okay, I'll feed the troll. WHY? Are you a muslim? You gonna kill me for suggesting such a thing? You gonna stab me and leave me dead with a note attached? You gonna threaten me and my family with death or dismemberment if I don't convert?

Koran 5:33The Punishment for those who oppose Allah and his messenger is : Execution or Crucifixion or the cutting off of hands and feet from opposite sides or exile from the land.

Okay, so maybe you aren't a muslim. Do you even know what Muslims teach from

I'll have to admit that a small part of me wanted someone to drive up in a large vehicle and drive through the lines outside the airport killing and injuring dozens when the TSA retards had people lined up outside of the airport buildings in the last "security crisis"

And that's the crux of the problem - he didn't act like a researcher (as he claims) and merely point a security hole (as you claim). He crossed the line from researcher to (potentially) criminal when he published a tool on the web that had no other purpose than to make it possible for others to circumvent security.

Well, he figured that the only way they would FIX the security hole was to make it public. He didn't consider that Soviet style suppression of information would be how the U.S. government chooses to solve it's security problems.

He crossed the line from researcher to (potentially) criminal when he published a tool on the web that had no other purpose than to make it possible for others to circumvent security.

The purpose was to shame the TAA into fixing a problem which was widely known and publicized:
August 2003 by security expert Bruce Schneier [schneier.com],
February 2005 in Slate [slate.com],
February 2005 press release by a US Senator [senate.gov], February 2006 article in CSO Online [csoonline.com]. The TSA has been ignoring the problem for over three years. Bad guys have known about the attack for at least three years, possibly longer. For all we know bad guys are using it right now; we have no way of knowing. Even without Soghoian's program, it was really, really trivial to exploit; all you need is a very basic understanding of HTML, enough to change one name to another, to execute the attack Schneier described in 2003. The media has been letting the TSA continue to ignore this. If Soghoian had simply published a "I can make fake boarding passes and get into the "sterile" area of an airport he would have gotten an article or two and nothing would have changed. By providing a working exploit things just became that much harder for the TSA. News coverage exploded. Finally something will happen.

The TSA has proven itself grossly incompetant. There is little to no oversight and zero public accountability. Drastic measures were necessary, as rational measures have clearly failed. The really sad thing is even in the face of such a drastic failure, they're not fixing the core problem.

And yet I'll bet if buddy puts on navy blue pants, navy blue jacket, a white shirt (or whatever UA employees wear), plus a nicely laminated photoshop badge, and walks around the end of the counter instead of jumping over, he'll have the run of the place.

This is the same problem with all kinds of security systems/programs. How does one point out the error/flaws in said system without falling afoul of the law(s)?

In this case, he would have been better off just telling people it could be done IMO. Just the same, if Kazaa isn't guilty, how can this guy be held responsible for what people did with his demonstration? If he personally used the fake boarding passes to fly and thus circumvent TSA rules, then he's guilty, should be punished. To demonstrate that its possible doesn't make him guilty. Even making it possible for others to do so doesn't make him guilty of anything except making the TSA look stupid.

Printing counterfeit money is not illegal... using it is. Normally, nobody would print it without the intent of using it, but in this case, the whole effort was to prove that it could be done and show that a fake boarding pass ruins security measures. If he can print fake boarding passes, any reasonably savvy group can. The manner used to demonstrate this flaw surely makes it impossible to not fix the problem?

Manufacturing counterfeit United States currency or altering genuine currency to increase its value is a violation of Title 18, Section 471 of the United States Code and is punishable by a fine of up to $5,000, or 15 years imprisonment, or both.

How does one point out the error/flaws in said system
without falling afoul of the law(s)?

Survey says - "Anonymously".

He could have written his boarding pass creator as a flash
app and uploaded it to Newgrounds. He could have posted a
JS version on any of a number of blogs without using his own
name. He could have even posted about it, with a link to an
anonymously hosted applet, and probably made the Slashdot FP.
He could even have gotten someone outside the US to host the
exact same content, with all occurrences of his name replaced
by "Mr. CheeseNips".

But no. He had to use his own name, and therein lies his biggest
mistake.

Anyone who says we don't need anonymity just doesn't fear the
government enough for their own good. And anyone who makes
the government look bad without at least trying to hide
their identity needs to study their history a tad more.

I, for one, THANK Soghoian for exposing a glaring
flaw in the farce we call the TSA. Not because it has made
us safer (as we can see, they chose to shoot the messenger
rather than, y'know, fix the goddamned problem), but
because it has slightly reduced the false sense of security
among the voting sheep.

Anyone who says we don't need anonymity just doesn't fear the government enough for their own good. And anyone who makes the government look bad without at least trying to hide their identity needs to study their history a tad more.

Although I agree with you, can I rephrase that?

Anyone who makes the government / any powerful organization look bad without at least pausing to think about the repercussions is foolish. Hiring a lawyer might be a good idea. Contacting the TSA and giving them six months notice is also a good idea. Contacting two or three major newspapers and letting them know about it is also a good idea.

But for once, I think Chris Soghoian is brace to use his real name and not hide. If he is really willing to face imprisonment and fines to make the TSA more accountable, the USA safer, and the draconian new "security" measures less credible, he's brave and patriotic in my book.

Worse, apparently a proof of concept isn't enough. The TSA is busy trying to presecute the messenger, but they still haven't fixed the core problem. I'd sadly forced to conclude that the TSA will not fix a real threat to airline security until terrorists successfully exploit that threat. While honest people are stuck measuring their shampoo out of fear of a deeply implausible liquid-bomb threat, anyone with access to a printer and a reasonably plausible state ID can get into the "sterile" area of the airport. (I find it darkly humorous that the boarding pass vulnerability makes the cost of getting 30 ounces of liquid explosives onto a plane just 10 fake boarding passes for almost no cost and 10 evil conspirators.)

So, a bunch of terrorists captured a couple of airplanes and flew them into buildings. Yeah, a bunch of people died, which is tragic. And the Economy Burped, which is... expected.

However, we've learned our lesson, and have secured the airplanes better. In addition, I doubt, HIGHLY DOUBT, that they could get anywhere close to doing the same thing, given the same circumstances, mainly because the passengers wouldn't stand for it.

Screening 80 year old grandmas of their knitting needles is stupid. Taking off shoes is stupid. Banning Liquids is stupid. For all the inconvenience of it all, it will not prevent someone from trying to by-pass whatever security is setup, and eventually they will succeed.

I know for a fact that I could bring a knife on board a plane even today, even passing through all the security. They can't stop me if they can't see it. And there are such knives available.

The point is, all this "security" isn't really designed to prevent hi-jackers, it is designed to placate the masses. See my sig for more info

Yeah, just put a plastic knife in your sock, underneath your foot. Bingo! You can slide right in with it. There are so many holes in TSA security that it's hard to know where to start pointing them out - and even harder to know when to stop.

So, a bunch of terrorists captured a couple of airplanes and flew them into buildings. Yeah, a bunch of people died, which is tragic. And the Economy Burped, which is... expected.

The economy was starting to downturn months before 9/11 - I was taking off a semester from school and working. I wanted to take another semester off and move to Calif. for 6 months, and in October 00, there were still jobs available for the asking. By January 01, the supply of jobs had largely dried up.

Agreed. The terrorist attacks changed *nothing,* unlike what so many political leaders have been telling us since moments after 9/11 ocurred. Yes, it was tragic, but it wasn't the result of some mass terrorist uprising. There have always been terrorists, and there always will be. "Terrorism" is simply the buzzword of the decade, used to manipulate people to particular ends. I wonder how long it's going to be before certain unnamed agencies are bitch-slapped back into legal and logical operations.

Don't trust the government. Whenever you feel the "I just want to help" vibe coming on, rephrase that into "How can _I_ profit from this?". If he did that he would have sold his generator to al-Qaeda for cash and retired by now. He wanted to "help" and he got screwed!

The thing is, Americans cannot understand how someone could possibly just "want to help" and not "want to make money". If such a thing happens, then surely they must be up to something, they are probably a terrorist and should be locked up anyway.

Is that their latest pre-emptive penalty, sticking people they don't like on the no-fly list? While not legally in the same category as house arrest, by infringing on his right to travel, have they or have they not already imposed a civil penalty?I didn't actually see a citation of where he'd been placed on the no-fly list, can anyone find one and post it? Probably not, since the list doesn't even technically "exist" except as an abstract concept... sorta.

Is that their latest pre-emptive penalty, sticking people they don't like on the no-fly list?

I don't see the societal benefit of this either. He released the software, rather than selling it or using it for his own nefarious purposes. So he's unlikely to be "up to" anything evil. Since it's a government mandated list and not optional for large private carriers to follow, they should not place people (at least not US citizens or permanent residents[1]) on the no-fly list without trial.

I didn't actually see the site while it was up, so maybe the guy actually DID this, but.To avoid being arrested, why not make the boarding pass have VOID VOID VOID printed all over it in such a way as it exposes the problem, but doesn't actually create a valid boarding pass. Then he would have violated no laws, AND exposed the poor security procedure at the same time.

Once the story broke he could create a boarding pass that's given to someone that's authorized to test the fake boarding pass, or others othe

They're just not going to leave the poor guy alone. He embarrassed them, and they're going to make him pay and pay and pay. It looks a lot like getting on the wrong side of the RIAA. They can be entirely wrong, but it costs you a fortune and year(s) of your life to win, and then they only pay a pittance for all their unwarranted grief at best.

There's no reason to believe he even might endanger any airplane that he boards. There's not even the thread of suspicion you'd get from guilt by association. There's no allegation that he has violent tendencies or has threatened violence.

He's there because the no-fly list is a tool for control and coercion at the whim of the authorities without the restraint of statute or jury.

Soghoian claims that he wanted to demonstrate the vulnerability. You could argue that he went about it in a stupid way, but I don't think what he did is substantively worse than what I wrote in 2003. Or what Schumer described in 2005. Why is it that the person who demonstrates the vulnerability is vilified while the person who de

This is a little bit frightening to me, not because they're prosecuting him and all, because I've come to expect that, but because of where it could lead. We all know that security is never permanent. If there is a way to stop someone from doing something, there is a way around it. What happens when the government realizes this? Some of the cases that get pushed through, like this one (IMHO, anyways) are ridiculous, but what happens when the government realizes that it's just the tip of the iceberg? It sounds kinda funny now, but after seeing the ways in which the government has evolved over the last few years, I would believe anything of them. What happens when they start bringing cases against people who make a proof of concept? Once we know something can be done, the rest is relatively easy, right? So proving that something can be done is like telling the terrorists how to do it, right? Of course, once you think of an idea of how to do something, you've taken your first step on the road to making a proof of concept, am I right? I look at those last few sentences and it makes me shudder, how absurd the logic is, but it's all too familiar to me. It's very like certain justifications to get a hold on certain domestic phone records, or even records from your local library.
I've always been of the opinion that America is the best place to live (for me, at least), but if thought processes like this continue to spread and grow, I don't know that America will continue to be a good place to live for very much longer. I like my freedom, and I am not willing to give up personal freedoms in order to lead a life filled with a false sense of security, under a tyrannical government that is unwilling to admit that it can and does make mistakes.

was never convicted in criminal court. The IRS got him in tax court for not paying taxes.

So justice had there try. Now its TSA's turn. Next the IRS will look over his finances looking for undeclared paypal donations for his defence, student loan fraud, etc. Next the army will conscript him under some secret law, and send him to Iraq. If they still can't get him there is always the RIAA & MPAA.

That's the United States today, unfortunately. If I had the financial resources I'd move to Europe, Russia, Asia, Australia, anywhere other than here. Anything is better than the $@&^ed-up crap our government is getting away with now. They are a bunch of psychopaths that can't stand to have anyone smarter than they are (which is any non-government employee) point out their flaws. I'll be glad when the common people of this once great nation are fed up and take it back. Terrorist attacks on the Unit

I *so* wanted to mod this post "troll," but that is unfitting - your ideas are not meant to provoke, but to unprovoke, and breed grudging contentment with the sad status quo. So no troll moderation for you. Sadly, there is no "defeatist fucktard lemming" moderation available. That would be fitting.

Well, it would be both. Any artwork you create is automatically covered by copyright. Now that you mention it though, fair use is probably a defense - he was constructing criticism which falls under fair use law. Trademark, on the other hand, would likely nail him.

No, if he was a criminal he'd have kept it quiet and sold it. How do we know a criminal's version of this scheme wasn't already running? We don't, but we know that now it won't work. For every security researcher there are 3 self-serving fiscally-motivated elitist assholes and it is the security researcher's moral obligation to practice full disclosure (after giving the company notice and time to fix the hole).

Do you think the flaw ever would have been brought to attention had he gone through the proper channels? I for one am happy he did this and brought it to everyone's attention, once it's out like this it's hard to down play and ignore.

People have been saying it for years. Last I checked, with E-tickets, you didn't even need a boarding pass---a printout of an email message was enough. (This should be changed if it hasn't already been.) The proper channels have repeatedly ignored complaints about this. As such, this guy should be protected by something akin to whistleblower laws, but I don't think there are any at the federal level except between employers and employees, sadly.

So when normal attempts at bringing a problem to light fail because they are to lazy to fix what is found he should just drop it till someone with malicious intent finds it and then start screaming "I TOLD YOU SO!!!". Great idea, I'm sure that would console everyone who was hurt or lost friends and family because of the problem. Pardon him for not wanting people to get hurt first.

Your argument is simply foolish. The TSA is inept at running a dept, so they are also inept at hiring researchers or security folk to check up on their stuff. This is a government agency. This person committed no actual crime -- he didnt use one, and didnt even print one.

The criminal would have kept this secret, and used it to his/her benefit by selling it to terrorists, criminals, or whatever. Those types of actions should be punished, SEVERELY!

What did he do? He made us all safer. He did it by exposing how ridiculous the TSA is, and gave them all the knowledge to fix the problem. He did not personally gain from this experience. If anything, he has suffered already for it much more than he ever should have. I would feel differently if this was a private company and not a public-oriented service (like AIRLINE travel), to which my tax dollars go (both to bail out airline bankruptcy, as well as to operating the TSA).

IU needs to stick up for their researchers, and foot the legal bill. I doubt they will, however, having been a past student, the administration at IU is pretty much inept equivalent to the TSA in my eyes.

Well, his intentions were obviously meaningless, since I can apparently still print out [aa.com] my own boarding passes [southwest.com], legit or not.

It's a shame the TSA people think just like you, if people would quit trying to kill the messengers, we might start seeing something that looked more like security and less like cronies securing contracts.

No, I strongly disagree. The DOJ has already decided he is not a criminal, or at least decided not to procescute. TSA seems to be getting their panties in a wad because he pointed out that the system is flawed, and did it in such a way as to force them to fix it. However, he didn't defraud anyone. He didn't use the tool to fly or to even bypass security.
Seems to me, that after 4 years of TSA "Security" (more actually, but lets count from 9/11) stupid holes like that one should have been fixed.

Fatherland - a bunch of old Germans raise their eye-brows and say, "Hmm, ve like it. Dat is a good vun."
Motherland - a bunch of Russians raise their eye-brows, then sit back down at the barage of Soviet Russia jokes bandied about here.
Homeland - a bunch of Rednecks raise their beers and shotguns, create a lot of noise, then start calling their hatred of non-Anglo's "patriotism".

We need more security than on 9/10/2001, not less. Congress should grab hold of the BS TSA next year and remake it according to our ranks of real security experts. Along with the rest of the leviathan Homeland Security Department, with its flagship FEMA.

I may add to this that it's citizens' responsibility to keep the country secure - this job shouldn't just be handed out to specialists. I'd not be averse to six months to a year of mandatory military training for all able-bodied citizens between 20 and 40

I've never heard anyone suggest 6-12mo mandatory military training, with only volunteer military enlistment. Like mandatory ROTC. It's a very interesting idea.There's about 1.2M highschool graduates [bloomberg.com] this year, and supposedly 7.5M US citizens [wikipedia.org] enrolled in the ROTC (though that seems high, and is uncited). It seems that the ROTC is already serving the right scale of enrollees. I'd favor replacing mandatory HS gym classes with ROTC for at least a year or two, required for HS graduation. Perhaps even mandatory s

Nor would a suicide bomber have publicized the security hole (if it *was* a security hole, since the only true security is physical security - metal/explosives detectory, x-ray machines, and armed pilots/sky marshals - having to show ID is just something to make the sheeple more comfortable). The suicide bomber would have used the hole if he could have and kept his mouth shut. So, the guy actually did the USA a service by publicizing the hole before it was exploi